Wireshark-users: [Wireshark-users] Extracting outer MAC Address
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Rayne <hjazz6@xxxxxxxxx>
Date: Mon, 19 Jan 2015 06:00:33 +0000 (UTC)
Hi all,

I have vlan packets that contain 2 Ethernet headers, and I would like to extract all source MAC addresses from the first (outer) Ethernet header. However, tshark automatically extracts the second (inner) MAC address.

What I have is

tshark -r file.pcap -T fields -e eth.src -w output.pcap

How do I extract only the outer MAC address using tshark?

Thank you.

Regards,
Rayne